This year’s lecture was called ‘How Digital Transformation supports Purpose-Led Financial Services’ and was delivered by Will Carroll, Chief Executive of Monmouthshire Building Society and Sarah Williams-Gardener, Chief Executive of Fin Tech Wales.

One of the benefits of Digital Leaders is the range of sectors and experiences it brings together and it was great to be able to take some time to focus on the impact and opportunities for digital in Wales’ financial sector. 

There’s an increased recognition that digital is not all about technology. More than ever digital is shaping the way services are delivered, how we step up to the challenges we face in the world today and how we meet the ever-changing needs of users.

It can often be too easy for us to think about digital within our own silos, whether that’s by sector or experience. But regardless of sector the services we deliver need to work for the people who use them.  We want our services to be seamless, using digital and technology to deliver enhancements and efficiency, in particular when those services cross organisational boundaries and sectors.  Whether it’s usability, access, convenience, skills or innovation – we need to be working together to share learning so that whatever service the user needs, be that from the private, public, financial or third sector – they become seamless to the end user, making carrying out their business as easy as it can be. 

In his introduction Will spoke about Monmouthshire Building Society’s focus on digital as part of their overall strategy, with COVID increasing the demand for digital banking services by 48% bringing enhancements for members, efficiency through automation and enriching business intelligence.

Sarah set out the aim for Wales to be globally recognised as a centre of FinTech excellence through developing an ecosystem, digital skills and funding for start-ups and innovation. Sarah also talked about the ambition to move beyond simply creating financial services to ‘FinGood’ considering the ethics, social inclusion and climate impacts.

Both spoke of the need to break down barriers to digital and the importance of sharing learning and knowledge within the Finance sector and beyond.  There was a real sense that this was just a starting point with the clear ambition and desire to support Wales’ digital community and grow skills, knowledge and confidence in digital in Wales.

You can watch the lecture on catch up here: 

https://www.youtube.com/watch?v=AMzZdEy-GvQ

More thought leadership

The post How Digital Transformation supports Purpose-Led Financial Services appeared first on Digital Leaders.

How does nudging and behavioural science relate to the world of finance?  

It’s clear that nudges and tips from a sleep tracker can help consumers improve their sleep quality and that they can reap certain quantifiable health benefits in the mid/long term. 

If the financial sector seeks to tap the full potential of nudging, we first need to take a closer look at how nudging works. One of the most influential publications in the field of behavioural economics was written by economists Richard H. Thaler and Cass R. Sunstein. Their book ‘Nudge’, written in 2008, dives deep into how rapid and instinctive behaviour vs. conscious and deliberate actions influence both humans and, on a larger scale, societies and governments as well.  

Implementing nudging for sustainable banking 

Our wallets are powerful tools for climate action. Imagine you wake up in the morning and check your bank account over breakfast. As you sip at your coffee, you get a positive awareness boost from seeing that your online banking app shows a reduction of your CO2 impact. Just like your fitness tracker, your online banking app encourages you to steadily improve your climate fitness: fintechs such as Novus, the UK’s first B Corp certified neobank, have embedded a nudging feature into their green banking products, thereby offering customers a whole new way of conscious consumption. The Novus banking app uses the ecolytiq software to provide their customers with personalised information on their carbon emissions. The integrated feedback loops help customers better understand their impact and contextualise personal sustainability data, with the goal of helping them reduce their overall environmental footprint.   

The nature of consumers is shifting – long gone are the days of a passive consumer base doing everything that brands and companies want them to do. The power of technology – not only fitness trackers, but also the huge amount of information available on the internet – have made possible the transformation of passive consumers towards enlightened prosumers taking more conscious purchasing decisions with the swipe of their card. Decisions that – despite a more conscious way of spending – ultimately help reduce the environmental cost of their lifestyles.   

The market potential for conscious consumption driven through banking is huge: According to a McKinsey estimate, the global revenue potential of impact accounts amounts to $50-60 billion. Hyper-personalised financial products that put sustainability at their core increase a financial institution’s value proposition and thus render it a lot more attractive to today’s sustainability-conscious consumers. According to Cone (2017), approx. 85% of GenZ and Millennials prefer to buy from companies that address social and environmental issues.  

Unlike older demographics, the younger generation is well-informed about climate change since it will be the first generation that is directly hit by the effects of global warming.  

The pitfalls of nudging in the world of green banking 

Let’s face the uncomfortable truth: people don’t like to be told what to do. “Stop eating meat! Become a vegan!” won’t do any good. Even less so if it appeared as a prompt in your online banking app. This is an example of the automatic system that Thaler/Sunstein were referring to. There are better approaches for educating consumers towards more sustainable spending and, ultimately, conscious consumption.  

A method that will help banks to leverage behavioural economics through nudging people in their online banking can simultaneously incentivise sustainable spending.  

The secret power inherent to sustainability data-enriched online banking is that the content is a) hyper-personalised, b) leverages the well-known trend of the “quantified self”, as seen with fitness trackers and other IoT wearables.  

Sustainable banking is safe, easy to implement and, first and foremost, it meaningfully helps to engage consumers through nudging/promoting the conscious use of their money.

Read More Emerging Tech

The post The power of nudging and behavioural science in the finance sector appeared first on Digital Leaders.

Generally speaking, you often find an underspend on projects and lots of things cause it. A common example is an overly ambitious start date. If that’s pencilled in too far ahead of when the department is actually ready to start, this causes a delay that in turn impacts the budget. The ramp up of spending is slower than expected and it’s pretty likely that money will be left over at the end of the year. And any good civil servant will tell you there should always be contingency for those unforeseen circumstances.

So, how can government teams get the best value from their underspend? It sounds simple but start by planning for it now. Assume that there’s going to be extra budget and you’ll need to find ways to spend it. The best time to do this is between September and December. As well as giving you the best chance of getting something useful done, this happens every year for almost every organisation and suppliers get booked up. If you turn up with money in January, there’s a good chance that your regular partners will have been fully committed since the start of December.

Prioritisation and changing scope

Connecting wants and desires with the reality of delivering a project is difficult. There are many moving parts, and if everything is important then nothing is important. So, naturally as a project progresses there will be elements that have to be deprioritised. 

As deadlines creep closer, you often cut the scope of what you’re going to deliver. Despite everyone’s best efforts to try and fix the scope, budget and deadline – you can rarely have all three. Prioritisation calls are what make a project successful, so there will always be things to pick up later.  

Assume work will be de-scoped and make a written plan in advance for how you’ll use your underspend. Think about the priorities you have and what you’re working towards, and plan how you can get the most for your money.

If you do reach start to see underspend accumulating, there are always ways to get value from it. 

Paying down technical debt – As with any digital service, there is always going to be a build-up of technical debt. Those workarounds that were put in place temporarily and are still there years later? It’s worth revisiting them. By paying down technical debt you’re building a sustainable service and that will make future changes more economic. It means you can spend less overall, because there will be less complexity for your teams to deal with in future. Although this might not be the most exciting of projects, it unlocks all sorts of possibilities. 

Discovery and experimentation – The focus doesn’t have to solely be on development work. Discovery and experimentation are good areas to explore too. Experiments are an important part of any iterative process and sometimes that gets lost. There may be aspects of a project that were deemed too complex and deprioritised, this is the time to come back to them. It could also be an opportunity to start identifying the next class of user needs, what’s next on the list now the most important needs have been met?

Pick up where you left off – The way projects are run often means that at the end of a 12-week alpha, a team will immediately begin to delve into the next stage. Extending that work by a week or two is a good use of any underspend on your budget. It allows the team to incorporate the institutional knowledge and value they have built up and find ways to embed it into the organisation. 

Adding capability – Another thing to think about is adding people to a team. Bringing in other capabilities and capacity is a way to build resilience for the long-term. It’s something to consider if you’re in an experimental phase or have a long running stable project which extends beyond the financial year. Bringing extra people into the team can help support research, service design, co-design and facilitation. But again, these decisions should be made sooner rather than later.

Don’t be afraid to tap into the rainy-day fund

Underspend happens. It’s a cycle that repeats itself year after year, so it’s best to assume it’s there and plan accordingly. It offers a variety of opportunities to enhance digital projects. Whether it’s paying down technical debt, refactoring code, building new features or working on infrastructure. It’s about using this money to make programmes, projects and teams more sustainable. Plan ahead and create capacity that will help in this new financial year and enrich your services.

More thought leadership

The post Planning ahead for underspent budgets appeared first on Digital Leaders.

The metaverse is, at present, a broadly blank slate. This means that, with the injection of true purpose, it could serve as a fundamental component of scalable social care, pharmacies of the future, shopping and connected cities – much more than a glorified Second Life style online game. For example, some 40m people visit NHS.uk online every month. Investment in an accessible NHS.meta is critical now. Otherwise, we continue the path towards this being a technology for gamers, savvy early adopters, and GenZ.

Applying some insights from human experience design is required immediately if we are to avoid the poor defragmented user experiences that exist between websites, smart device UIs and apps. Humanity in the user experience design of metaverse interfaces could be a game changer – gaining digital skills within the metaverse and accessing devices to participate and be an active member of the community FOR ALL, not just a savvy few.

Akin to the consistency and standards throughout app stores, the Metaverse must have planning laws established now to address learnings from Web 2.0, VR, AR, and even the early Metaverse where founders like Phil Rosendale of Second Life shared their breakthrough learnings as the proto-metaverse.

We wouldn’t dream of building a house without planning permission – Metaverse planning laws, accessibility, ethics and access laws/regulations need to be developed and agreed now. Otherwise, we’re starting Internet 5.0 off with the same issues as 1-4, disparate user experiences and interfaces with device compatibility issues and a further divide for the hidden communities that would truly benefit from this. Whether this structure needs to come from Meta or from other early shapers of metaverse experience is moot. If this ‘wild west’ approach to such a rich virtual environment continues, a lack of consistency and cohesion will stop it from becoming a true force to shape social good.

We need more physical spaces to ensure our amazing technical advances and creativity in the metaverse is not further intensifying digital exclusion (because of lack of skills, training, environment, technology, device compatibility, money). Whilst in the UK 78% of people go online using a mobile device, and 90% of households have internet access there is still a significant problem.

Some 11.3m (22% of the population) do not have the digital skills required for even everyday life in the UK (Disabled communities are 35% less likely to have the necessary digital skills – with current accessibility and user experience).

The spending power of disabled households is well documented, with digital inclusion far from being solved. Brands need to wake up to the reality of the Purple Pound (referring to the spending power of disabled households). 1 in 5 potential UK consumers have a disability, with a spending power of over £274bn, yet 75% of disabled people in the UK have abandoned a brand because of poor accessibility. Wake up and use the Metaverse to reverse this injustice. Banks and building societies and supermarkets are amongst the worst offenders.

The proto-metaverse to date has been devoid of true equality. Community moderation, AppStore level QA and validation, as well as the need to fearlessly focus on ensuring toolkits embed standards of quality and remove vulnerabilities by design. The ecosystem should also embrace open partnerships to invest in meta-philanthropy to solve for the tech inequality in communities and sectors that will benefit most.

The metafuture is exceptionally bright. As both a data evangelist and technologist I am incredibly enthused by the stimulating positives we and many others are exploring in the Metaverse. However, caution and consideration on the long-term implications of the actions we take now are necessary, to ensure our efforts and massive investments are a true force for good in the evolution of this exciting innovation.

More thought leadership

The post The time is now to shape a Metaverse for Good appeared first on Digital Leaders.

Technologies such as reforesting, rewilding, and direct air capture have showed promise. Governments around the world have also set the target of nations achieving Net Zero, where no more harmful emissions are produced than the amount reabsorbed (most likely through a combination of natural processes such as photosynthesis, and man-made solutions such as carbon capture devices).

Blockchain technology does not have the best reputation when it comes to the environment. Cryptocurrency, the most well-known application of blockchain, has caused a boom in highly energy-intensive activities such as bitcoin mining and producing NFTs. However, blockchain is a technology with many other potential uses and could be a useful tool in achieving Net Zero.

The challenges of achieving Net Zero

To have a shot at achieving Net Zero, let alone the ideal “carbon-negative”, we cannot rely solely on technologies—emissions must also be reduced as quickly and as much as possible. This means that public and private organisations of all sizes must review every single process and appliance used to carry out operations and replace them with sustainable ones.

This includes not only internal processes, but those of any suppliers or partner organisations. Every aspect of an organisation’s effect on the environment must be audited. Accessing the vast amount of data that this entails is not only practically difficult, but also risks violating data protection regulations.

Even with technologies and infrastructure that would solve these particular challenges, achieving Net Zero is a difficult task. Without these technologies, however, it may be an impossible one.

How do blockchain technology and DLT work?

Although the terms are often used interchangeably, blockchain technology is just one type of DLT—or Distributed Ledger Technology. DLT describes technologies that store data in decentralised ledgers, with access managed by administrators and/or programmed authorisation rules. Blockchain, and its continually verified encrypted data blocks, is a type of DLT, as is the newer DAG (Directed Acrylic Graphs).  

The environmental uses of DLT

The applications of DLT for secure and reliable data sharing are established, with the technology enabling decentralised yet secure data storage. This could minimise the security and logistical challenges of sharing emissions data between organisations, with immutable data accessible for every step of a supply chain and by any organisation that needs it. 

With data stored using DLT platforms, transparency could be increased, organisations empowered to make informed decisions on their suppliers and partners, and unscrupulous actors prevented from falsifying data. For example, wealthier nations could be prevented from excluding overseas emissions (such as those from agriculture or manufacturing outsourced to poorer countries) from their national recorded emissions.

Carbon offsetting, one of the procedures that has been explored to help organisations reach Net Zero, has been plagued by practical issues. “Double-counting”—when multiple people or organisations claim ownership of an offset, causing it to be re-used without more carbon-reducing measures being taken—is a particular problem. 

Double-counting could become much more difficult with data stored using DLT. Tokens could be created to represent carbon offsets and tracked reliably in a tamper-proof ledger. In fact, a decentralised ledger of carbon credits has been trialled by the Partnership on Transparency in the Paris Agreement.

It is not just accountability and transparency that DLT could provide. Reliable ledgers could enable more efficient and sustainable resource management in energy and water systems. Especially when combined with smart sensors, waste could be curbed and energy use tracked and monitored in real-time across large-scale infrastructures. The potential implications for disaster relief are also significant, with decentralised shared information enabling faster and more targeted responses.

DLT and the future

No technology is likely to reverse climate change alone. As well as tracking emissions, they must be hugely reduced.

 DLT is one of numerous tools at our disposal. However, we must have the collective will and organisation to use it the right way. Even decentralised technologies require human input, and those granted access must be trained, knowledgeable, and willing to put the planet above any other short-term interests.

The international collaboration required to save the planet will take immense effort. This is no easy task, but technologies like DLT could make this collaboration more informed, practical, and focused.

Read More Net Zero

The post Can Blockchain save the planet? The role of distributed ledger technology on the road to Net Zero appeared first on Digital Leaders.

So, what is the current state of the DLT world in 2021? 

What is Distributed Ledger Technology?

DLT is an umbrella term that encompasses various platforms and technologies. The basis of DLT is a shared ledger—a form of decentralised database that does not require a central authority in order to function (although administrators can be chosen to program and monitor access rules). DLT networks store data using cryptography, which makes them more secure than traditional databases or ledgers.

Although the concept of a distributed database goes back at least decades, most examples that exist are still reliant on a central system, which is not only less efficient than a decentralised ledger but can be a tempting target for cybercriminals.

The most well-known form of DLT is blockchain, which is most often recognised as the technology behind cryptocurrencies such as Bitcoin and Ethereum. Although the terms are often used interchangeably, blockchain is merely one type of DLT, as is DAG (or Directed Acrylic Graphs). 

Although DLT is most familiar to the public for its cryptocurrency applications, it has numerous other uses.

DLT in 2021

The impact of DLT on the financial sector in 2021 alone has been immense, with new cryptocurrency trading platforms making it easier than ever before for consumers to trade in crypto. In response to widespread consumer desire for cryptocurrency options, many banks are also now considering using blockchain and cryptocurrencies. 

Blockchain technology itself is also developing rapidly, with the “proof-of-stake” algorithm becoming the standard in certain protocols. Compared to the original consensus protocol “proof-of-work” (which powers Bitcoin), proof-of-stake is more economical and energy-efficient, and believed to be less vulnerable to hackers. Ethereum, one of the largest cryptocurrencies, is currently transitioning from a proof-of-work to a proof-of-stake algorithm. If proof-of-stake becomes the standard, many of blockchain’s issues around energy usage could shrink dramatically, further increasing public trust in the technology.

The innate security of decentralised ledgers makes them promising investments for many companies. In May 2021, tech giant Microsoft announced that it would be shutting down its Azure Blockchain service. Speculations that this marked a step back for DLT were corrected only weeks later, when the company announced that the service was in fact being replaced by a new, more secure Confidential Ledger still based on blockchain. 

Microsoft also launched its decentralised digital identity system ION in 2021, an implementation of which had been successfully tested with the UK National Health Service. With the COVID-19 pandemic highlighting the need for reliable, secure identity information (e.g., vaccination status records), the uses of DLT in the public sector have become increasingly apparent.

DLT has also made strides in the security and accuracy of data sharing in 2021. For example, DLT platform SICCAR was used to develop an Open Referral platform that enables charity organisations to self-publish details which are instantly accessible to local authorities. Projects such as this not only reinforced DLT’s strengths in data security, but also showed its potential uses in the increasingly important arena of social value.

How could DLT be used in the future?

The blockchain distributed ledger market is expected to reach almost $140 billion USD by 2027. Aside from financial effects, promising technologies usually come with boundless speculations about their potential effects on society. DLT is no exception, with predictions ranging from making supply chains more efficient all the way to saving the planet and replacing the state. 

Aside from the utopian (or, in some cases, dystopian) visions of blockchain-based societies, we can expect to see DLT play a steadily increasing role in our everyday lives in the short-to-medium-term. The COVID-19 pandemic only sped up the DLT trend as more and more financial, social, and logistical processes took place digitally. Widespread adoption of DLT could potentially change everything from the way we use banks to the way votes are counted and laws enforced.

However we choose to use it, Distributed Ledger Technology is here to stay.

More thought leadership

The post 2021: the year Distributed Ledger Technology took off, big time appeared first on Digital Leaders.

As a result, the ever-growing collection of small, yet critical, open source projects that are the foundation for so much of what we do continue to lack investment.

As ever, there is an xkcd that neatly illustrates this problem:

My plan for the OSSF conference was to do a deep-dive into a popular open source project to show its complexity, and highlight the associated fragility. Ultimately I wanted to draw an analogy between the problem illustrated in the above comic, with the 2008 financial crisis, where the complex structure of financial instruments hid the underlying exposure to sub-prime mortgages, which ultimately failed and caused a collapse. Surely this would raise a few eye-brows and generate some interesting discussions!

My talk was accepted and I was keen to stimulate a lively debate. However, sadly this conference was pushed back to later in 2020, and became a virtual event. Unfortunately virtual events work reasonably well for passive consumption of content, but are a poor substitute for more active debate and discussion.

As events are likely to remain virtual for much of next year, I thought I’d reproduce my talk here, in the hope that I can create some debate in the online world!

What the financial crash can teach us about open source

I want to tell you all a bit of a story … I’ve been getting increasingly concerned about the complexity of our open source software.

Software architectures are becoming increasingly componentised, and more often than not, these components that form the foundational building blocks are open source. However, before adopting an open source component, I try to ask myself; Who writes this code? who maintains it? is it a sustainable project? and ultimately, am I going to regret using it? In other words, is the short-term benefit of using this building block going to be eclipsed by some more long-term maintenance issues.

These are not easy questions to answer and more often than not, I don’t see people even attempt to answer them. I’ve seen some surprising choices made in the past, with open source projects that are clearly not maintained or sustainable being selected as a important foundational components for a project.

Complexity and fragility go hand-in-hand. When a foundational component fails, the entire product built on top of it fails. There are also a great many ways a failure can occur, from something quite sudden and critical, such as a security vulnerability, to the more gradual erosion caused by a component that is no longer actively maintained.

To turn this into something concrete, I decided to focus on a real-wold example, by picking a popular open source project and taking a deep-dive into how it is composed.

I opted for ExpressJS, a 10 year old project with 50k stars on GitHub and 15m downloads per week on npm. A project that I have used myself a great many times.

Surely a good choice?

So let’s start asking ourselves the important questions (Who writes this code? who maintains it? is it a sustainable project? etc)

The first thing I want to do is gain a better understanding of the composition of Express. By looking at the dependency graph I can see that it is composed of 49 seperate modules (or packages):

When you install Express on your machine, these dependencies are resolved (and their respective dependencies reursively), and downloaded as part of the installation process. As I observed earlier, modern software is highly componentised.

This is quite typical, not just for JavaScript-based projects. You’ll find similar dependency graphs for projects written in Rust ior Python.

I was interested to see how this had evolved over time, so I downloaded all the 163 releases of Express and plotted their total dependencies:

You can see that Express itself has become increasingly componentised over time. Interestingly, the number of dependencies dropped significantly when v4 was released, only to start rising once again. Major releases are often a convenient time for consolidation and clean-up.

I can see the benefits to a more componentised approach, these high-level building blocks allow you to quickly assemble new and novel solutions (for example a few years ago I wrote my own static site generator in little more than 100 lines of code). However, if I’m trying to assess the overall health of Express, I’m not just checking 1 project, I’m now checking 49 of them!

However, this dependency graph is only half the story. Projects like Express have an additional set of dependencies that are used during the development process. In this case, Express has a total of 195 development dependencies when the dependency graph is fully resolved:

Should I care about or be worried by this? Whilst these dependencies are not shipped as part of the Express distribution, they can have an impact. There are an increasing number of software supply chain attacks being reported, where attackers target vulnerabilities in the development dependencies, or build pipeline in order to insert malicious code.

This is starting to make me a bit nervous, but let’s go a bit further down this rabbit hole. When I install Express what exactly am I installing?

Semantic versioning was proposed 10 years ago by one of the founders of GitHub. It is a simple mechanism that conveys meaningful version numbers as illustrated in the diagram above. Notably 0.x.x versions don’t follow the same rules as 1.x.x versions in that any change can be breaking, in other words, 0.x.x versions aren’t really semantic!

10% of Express dependencies carry 0.x.x version numbers, and as a result you have no way of knowing whether a version increment will carry a breaking change.

Furthermore, it is common convention to express a dependency on a version range rather than a specific version number. For example, the following range permits bug fixes and new features, but no breaking changes:

I must admit, I’m not sure why you would want to do this! What this means is that for a given dependency, at some point in time in the future, your declared range might result in a new version arriving as part of your installation, with new features and bug fixes. However, without writing additional code yourself, how are you actually going to make use of these new features? and worse still, who determines whether a bug is a bug, or a feature? You could have a workaround for a particular bug, or might even consider it a feature. This new version will cause things to break in either case.

It sounds like a nice idea in theory, but in all honesty, I just can’t see any of this working in practice. I like my software to behave repeatably and consistently. Bugs and all.

Considering that Express has ~200 dependencies, I started to wonder how often one of these would release a new version that was compatible with the dependency version ranges declared by Express, resulting in a different version of that component being downloaded.

The answer is, quite often!

Between just two versions of Express, over a 7 month period, releases in dependencies result in 33 differ configurations.

As an aside, there are various techniques that can be employed to remove this variability. For example you can use a lock file to pin your dependencies to a specific version. However, this is an opt-in process that is not without issues. For starters, yarn and npm have different lock formats (I’ve wasted a lot of time trying to track down an error only to discover I’m using the ‘wrong’ package manager), also they are a bit of a security blindspot.

OK, now I’m getting scared! We have a complex dependency graph, that is ever changing. But where does this code cme from? Who holds the keys? and who decides what is released and lands on my machine?

For JavaScript projects, npm is the package manager and repository that holds the released artefacts. For Express, this is the 49 components / packages that are deployed to your machine on installation.

I took a look at npm, and found that these packages were ‘governed’ by a total of 88 maintainers. The following chart shows the number of maintainers for each package:

Those coloured in blue are ones where the maintainer for Express itself is also a maintainer.

Here’s an interesting interesting statistic for you … only 9.27% of npm maintainers have 2 factor authentication enabled. What this means is that if you obtain a maintainers username and password, you are free to publish new versions of their package, releasing malicious code into the wild if you so wish.

From inspecting the package meta-data, I now have the email addresses of these 88 maintainers. I typed the first one into have I been pwned?, and sure enough, passwords associated with that email had been exposed in a number of recent data breaches. Given 88 maintainers, the lack of 2FA and people’s habit of re-using passwords, I think the chances of gaining access to one of the packages that ships with Express is really quite high. No, I didn’t try.

I think we’ve gone far enough down this rabbit hole. A project like Express brings with it a lot of complexity, which in turn can result in hidden fragility.

Here’s a recent example of how a small seemingly innocuous package that is relied upon (most often indirectly) by a great many other projects can cause the whole structure to fall apart:

Let’s take a break from diving into the dependency graph and look at Express from a different perspective – funding.

Who writes this code? who triages the issues? who maintains the project? and how are they rewarded for it?

From looking a the project activity history on GitHub it is pretty easy to determine that with the vast majority of commits coming form a single author, that this is effectively a solo project. I took a look at the website and README and can see no obvious funding model, whether through individual donations or corporate sponsorship.

I also looked at the Express dependency graph and of the ~200 packages / projects this includes, I could only find one that was funded, and that is eslint, a linting tool for JavaScript.

Eslint is a member of Open Collective, a company that provides a funding platform for open source projects, handling one-off and recurring payments, whilst also providing lightweight due-diligence on how this money is spent.

Eslint has a variety of company and individual backers:

So just how much revenue does this generate? Eslint is one of the most successful (i.e. funded) projects on the platform. I took a look at the top 30 projects (by funding) and converted their annual revenue into a rough full-time-employee equivalent:

As you can see, Eslint raises enough to theoretically employ 1.5 developers. Most of the top projects raise considerably less than this, and the long-tail of projects that fall outside of this top 30 earn even less still.

For most projects this funding model is an added bonus, and not a means for sustainability of itself.

However, open source maintenance isn’t all about money. A great many maintainers invest their time, love and energy into their projects simply because they enjoy the creation process itself. Unfortunately burn-out is a very real issue in open source, especially for those that do it for the love rather than the money. Once the pressure of maintaining an open source project become too great, and the joy is gone – what reasons are left for continuing?

Sadly while exploring the (lack of) funding for Express I found this tweet:

Without going into the details, a potential security issue with Express was highlighted. What followed was various differences of opinion, quite a lot of “security theatre” (commercial security products labelling Express as insecure), hostility and heated exchanges. As a result, the maintainer publicly stepped away from the project for a short period of time.

I must admit, I wasn’t expecting this. I picked Express quite by random. It is a mature, popular and widely used project. It is funded by Open Collective, it is also a member of OpenJS, a Linux Foundation project for supporting popular JavaScript projects. However, if I was making a cold hard assessment of its long-term viability, I’d have some serious doubts!

The whole ecosystem seems so fragile. I can only conclude that the only reason this all works is that the vast majority of people are good.

… but we sure as heck don’t make it easy for them!

So what has all of this got to do with banks, financial services and large corporates?

I’d say that broadly speaking people are aware that there are risks associated with open source consumption, and that care should be taken when determining which projects to make use of. However, much of the focus is on legal and compliance, (e.g. checking licencing or copyright compatibility) and security. There is very little attention or concern expressed about the maintenance and long-term sustainability of these projects that are being consumed.

I do feel that the overall approach is somewhat medieval – with those within the castle taking the fruits of the labouring peasants that reside outside!

In practical terms there is a lot of time and hard cash spent on security scans, licence checking, internal repositories containing sanitised code and internal forks.

This quote from an open source developer on his encounter with a security software vendor at an open source conference sums it up quite nicely:

So this means that they charge a 50-person startup a whopping $30,000 per year to help them feel safe using code that open source authors like me have given away for free.

These products that make people ‘feel safe’ in their consumption of open source software can also have quite a negative impact on the open source software they are helping you consume. There are many automated tools that helpfully raise issue and pull requests when they feel something within your open source project requires attention, a potential security vulnerability or perhaps a potential version bump.

Unfortunately in practice, this tends to generate nothing but noise and distraction. For example, dependabot bombards me with dependency ‘bumps’ due to potential security issues almost every week.

However, just because a piece of software has a potential vulnerability, that doesn’t mean it will actually manifest itself as such in the product it is being used to create. In practice the vast majority of pull requests I’ve received from this bot are never going to result in a security vulnerability because of the way in which I use them (e.g. they might only be used at build-time, or are not executed client-side, or don’t received un-sanitised input, or …).

Unless this bot gains a better understanding of the context within which a dependency is used, it is always going to generate an excessive amount of noise.

This is an example of security theatre, highly visible activity that gives the impression of improved security, whilst doing little to achieve it.

For open source maintainers this can be quite exhausting. To quote on such developer:

If it’s not fun anymore, you get nothing from maintaining a popular package

So what is the solution? It’s not money, it’s not sanitisation and security scanning. It’s not creating a your own castle to protected your forked projects.

Personally I think the only way to come up with an effective solution is to have some empathy. You need to understand the open source ecosystem, what makes it thrive and what causes it harm. You need to understand the motives of the different participants.

This is a huge topic, and not one that I’m going to dive into in an great detail. What I will do is strongly recommend that you purchase and read the following book:

“Working in Public: The Making and Maintenance of Open Source Software” by Nadia Eghbal – a fantastic book that really dives deep into the open source community to find out how it works.

A few points that have really stuck with me …

GitHub has completely changed the open source community, and this change has been both good and bad. Early open source projects were disparate; little clubs and cliques which formed close-knit communities. People tended to have long-running relationships with these communities. With the rise of GitHub, most project and people now share a common platform. This has made it much easier to contribute to open source projects, however, these contributions are much more fleeting. Nadia compares GitHub to the types of community you find on YouTube, where you have solo creators and a sea of consumers.

For the creators, their most prized asset and scarce resource is attention. Open source developers have limited time to spend on their creations, and they hope that this time spent is fun. A growing number of fleeting interactions and well-meaning contributions (of limited value), security theatre, and numerous other distractions mean that their attention is consumed by tasks which they simply do not enjoy. GitHub has unfortunately made it too easy to contribute.

A great example of this negative cycle, limited attention and ease of contribution, is Hacktoberfest. An annual event from Digital Ocean that encourages and incentivises open source contribution by giving away T-Shirts. Sounds good in practice? But this year it fell apart quite rapidly:

Open source maintainers were flooded with exceedingly poor quality contributions, to the point that they branded it a ‘denial of service’ attack.

Digital Ocean certainly had good intentions when they staged this event. However, they misunderstood and misjudged the dynamics of how the open source community works.

So what should Big Bank, or Big Corp be doing to make a positive difference? I’m afraid I don’t have all the answers, but I do have some ideas and recommendations.

• Don’t create a castle or walled garden.
• Don’t focus on (or spend lots of money on) sanitizing and securing. Consume directly from the public package managers and if you find an issue, fix it at source.
• Do invest time in learning about the open source ecosystem. Read about it, meet the people. Join the community.
• Learn how to make effective contributions by educating your staff. It’s not as easy and obvious as it might sound, but it is a worthwhile endeavour.
• Help maintainers maximise their attention. In practical terms:
  • Answer questions about the project on Stack Overflow, discussions forums or any other relevant channel
  • Create better examples and documentation. This makes it easier for other consumers and gives the maintainer more time to focus on creating.
  • Help with issue triage
  • Fix bugs

As you can see there are a lot of practical things you can do to help create a more sustainable open source ecosystem. However, to make this work you need to allocate time and/or budget, simply relying on the good will of your development team, or out-of-office-hours contributions just doesn’t cut it.

There is much in common between the challenges of open source and the environment that causes the financial crash of 2007. In both cases there was a lack of understanding and an unwitting exposure. What I hope is different is the way that we tackle these challenges!

Join the conversation

I’ll be giving a talk on this topic at the Open Source Leeds meetup event on Weds 29 September. Having described the problem here, I’ll be offering in my talk a starting point for a discussion around a possible solution in the form of the Corporate Social Responsibility model. You can attend in person or via the live stream and there will be plenty of opportunity to ask me questions and share your insights.

You can find out more and book your place on Meetup.com.

Originally posted here

More thought leadership

The post What the financial crash can teach us about open source appeared first on Digital Leaders.

Do you check your balance before making a financial purchase?

I’m not necessarily talking about a coffee or lunch but let’s say before spending on something small enough that it doesn’t feel like a major purchase but big enough that it will have an impact on your cashflow. Do you shop around before renewing your insurance? Do you look around for cameras and police putting your foot down to get the next meeting on time? If so, you are making data driven decisions already in your life.

We all do this, every time we shop, drive, walk down the street; and increasingly we are making these decisions with the help of technology.

When was the last time you took a journey and planned the route by taking out a paper map to look at the route you should be driving on the roads? When was the last time you relied on receipts and your last statement to tell you your current financial position, the last time you renewed your car insurance did you call around, or use an online insurance aggregator to find yourself the best deal, or just let the auto-renew roll forwards?

Satnav, banking apps and aggregation sites are all examples of where we have come to embrace having data at our fingertips. The integration of data into our lives has been so universal, ubiquitous and easy that we no longer see it for what it is.

So now the big question, why do we struggle to do this in our work lives?

There are big differences in the use of data in our personal lives and our work lives. First there is the volume and complexity. Using data in our daily lives has been made easy, someone has done all the hard work for us and all we need to do is embrace it. In our work lives, often we must be the driver for change. The work needs to be done by us, or if not then we need to push for it to be done. The data does not always exist in nicely curated collections, and we may need to find ways to capture or collate the data required. There are often multiple systems that need to be brought together to deliver the insight required with no clear way of joining the data.

There are many competing technologies and methodologies, picking a direction can be daunting, especially when the cost of a wrong decision is a high level of technical debt, increasing costs and stretching timelines. A failed project can be reputationally damaging. So, with all of this in mind why is it so important that organisations embrace becoming data driven decision makers?

Because the cost of not leveraging your data so is higher. Without data to drive decisions we are left looking at anecdotal evidence and gut feelings as to which way we go. How many organisations have failed due to overextending? How many have failed because fraud or mistakes were covered up?

Robust data analysis brings problems into the light and identifies models of working that should be praised and expanded across organisations. It drives informed discussion and guides us in what is possible and what is not.

This is important in large organisations, in smaller ones it is critical. In a small organisation the effect of bad decisions is magnified. Tighter margins, less capacity and less access to liquid funds to shore up against bad choices mean that a smaller organisation can fail on a single bad choice. Given that the smaller organisation has less in the way of capacity to fund development of an analytics capacity to support this data driven approach how can this be delivered on a budget, making the best use of the resources available?

Most analytics projects that fail do so because they are not thought through fully at the start and the goal, and roadmap to reach it, is unclear. Many don’t even reach that stage because they are thought through so much, they never actually start. The key to delivering an analytics project is asking the right questions and making the choices that need to be made now, leaving the ones that we don’t need to make now until they are needed to be made, mindful of the end goal.

The key choices that need to be explored prior to starting down this path are: 

• Data Governance
• Data Modelling Methodology
• Reference Architecture
• Data Assets
• Analytics Opportunities

Understanding these from the outset will inform what you can and should do and how it will benefit you. It will also give you the ability to develop things in a modular fashion. Keeping a continuity of design while only standing environment and data up when there is benefit, avoiding unnecessary cost.

Why are these choices so important?

Each of these choices will guide how you build out your platform and will prevent you from creating technical debt that will spiral future costs.

Data Governance

Focusing on data governance prevents issues with GDPR, master data management, and increasingly Ethics. Making sure that Data Processing Impact Assessments (DPIA) are in place will stop work from halting while these are created. Data governance encompasses a lot of the non-functional requirements that are easy to put in place before you start but are a lot more difficult to add in once the build of the system is underway. Preparation is essential to prevent you starting and then having to abandon a project when the governance presents an insurmountable hurdle to your chosen approach.

Data Modelling Methodology

Deciding upfront which data methodology you will be using to create your staging and presentation layers in your analytics environment means that you can build in a modular fashion while keeping a standard way of design and implementation. This will enable the greatest synergies between data sources brought in.

Reference Architecture

Having a reference architecture gives you the ability to know what infrastructure and software will be required for a given type of analytics work. Building out a roadmap of analytics opportunities will enable you to stand up technical environments only when they are required, saving money on environment and support costs. It will also give a single point of signoff for any enterprise, solution and technical architecture boards; reducing the time taken to navigate these tricky spaces as your platform rolls out.

Data Assets

Identifying the data assets available and required will help to prioritise the opportunities identified. If data is easily available, the cost of an opportunity will be lower and therefore will be easier to recoup a return on the investment. If data assets are missing, then understanding if and how they created or collated and added to the solution, driving the maturity of the data asset estate and facilitating future opportunities, is necessary.

Analytics Opportunities

Identifying business driven opportunities within the analytics space will allow targeted development, standing up the minimum viable dataset to deliver a specific analytics outcome. Tying this to the modular approach means that it is feasible to only bring in exactly what is required to deliver what is needed for delivering the opportunity while leaving all avenues of future expansion open.

This approach to modular, rather than monolithic BI/AI/Analytics platform development is ideal for organisations looking to gain the most benefit possible from smaller analytics budgets.

Local Government, NHS Trusts, Smaller central government organisations and QUANGOs can benefit greatly from this approach. Building only what is required to drive specific analytics requirements; with the forethought to tie disparate opportunities into a modular platform will deliver more benefit for money invested.

Matt Thompson will be exploring this further at Council 4.0 on Thursday 13th February in London. For more information and to register, please visit Council4.0

Originally published here.

More thought leadership

The post How can we use data to help drive our business decisions? appeared first on Digital Leaders.

Using new tech to support financial inclusion

Through our Future Payments change programme we are exploring how we can support financial inclusion using technology. This will include supporting vulnerable groups; such as those who do not have bank accounts, those who request advances, adults with learning difficulties, and others who don’t or can’t use existing services.

We’re keeping an eye on the changing payment landscape, and have seen a number of new financial products and services which people are using to help manage their money, supplement incomes, get control of their debt or provide saving solutions. For example, UK start-up Tully is helping people who are burdened with multiple debt repayments. It offers a flexible debt repayment plan that takes just one payment, and adjusts to the person’s financial situation each month. And there’s Yolt, which is helping people by allowing them to see all their accounts in one place and set budgeting goals whilst giving advanced analytics on spending and income patterns, so that they can better manage their money.

How open banking is changing the payment landscape

These new products have been enabled by the open banking initiative, which was driven by the UK’s Competition and Markets Authority (CMA) to encourage competition within financial services. At the hack, open banking will be one area we’ll explore. Open banking is fuelled by technology, innovation and market forces. It uses open APIs to enable third-party developers to build applications and services around the financial institution allowing customers to access cheaper financial products and benefit from innovative applications and services.

Hacking for solutions

We’ll also look at other solutions to help support citizens, for example, how we support our customers without a bank account. People who find it difficult to open a bank account include some migrants, those who cannot provide proof of a UK address, and individuals with poor credit histories. There are also some people who do not want a bank account.

To support them, could we look at solutions to provide a product or service that would be a stepping stone to getting a bank account?

In DWP’s last Financial Inclusion Report, we found there were 1.23 million people without bank accounts. Currently we provide a Payment Exception Service to provide welfare payments to citizens without accounts. However, the unbanked potentially face additional costs that can be up to £485 each year for bills and basic services because they don’t have the support of a bank.

Originally published here.

More thought leadership

The post How can we boost financial inclusion for our citizens using technology and innovation? appeared first on Digital Leaders.

To support Fair By Design’s mission of eradicating the poverty premium in the UK, we launched the Fair By Design Roadshow, convening regional decision-makers from the private and public sectors who are collaborating to reduce unfair living costs for low-income households using the latest social innovations. These include housing associations, credit unions, large employers and local authorities capable of adopting tech solutions that are reshaping essential services (energy, finance, insurance, food waste, digital inclusion, and employment).

Discussions from the expert panellists at our inaugural April Roadshow in Oldham, Greater Manchester underscored key considerations of adopting digital solutions for financial wellness.

Going Digital in the Lending World: a Double-Edged Sword

The first thing people tend to think about financial wellness is access to credit: a relatively longstanding and effective category of digital solutions. Indeed, Payday lenders are known to have some of the smoothest customer journeys and fastest turnarounds for short term lending. They are also some of the worst triggers for debt spirals, compounded by the opaqueness of late repayment fees and extortionate APRs, which can sometimes make the interest cost higher than the principal itself.

This is where it is important to note that digital solutions do not drive financial wellness, rather, combining them to existing ethical financial infrastructures can scale effectiveness.

Cost-effectiveness, Access and Engagement

Recently, the FCA called for the expansion of Credit Unions (CU) as a viable alternative to the Payday loan market. They are structured as not for profit cooperatives and currently, there are 400 CUs operating in the UK controlled by c.2m members. Yet, one of the biggest issues for CUs and other community banking institutions is the overhead cost of maintaining physical branches, impacting other essential budget lines such as marketing, hiring, and loan monitoring. A limited marketing budget and fragmented digital presence contribute to CUs and other community banking institutions being an under-used solution, despite their growing footprint and lending books.

To this end, FinTech Incuto is a welcome integration-based platform for CUs, enabling their customers to not only apply for loans online in a faster and more efficient way, but to gain financial freedom and access to services with the same level of interaction and engagement that they would receive from a high-street bank. Incuto also allows CUs to use more payment solutions, more cost-effectively. Vulnerability is still a key component for many low-income customers and the cost efficiencies achieved through a platform like Incuto allows CUs to maintain a tailored level of service for those needing more support.

Financial Resilience

Lending isn’t the only source of financial wellness. The ability to manage a restricted budget resilient to financial shocks is paramount. Particularly in light of the establishment of the new universal credit system, household budgets are being further tightened. 85% of the UK is paid monthly, with the highest financial stress experienced towards the end of the month when most people are taking payday loans. If one had access to their earnings, this could be prevented. Income streaming platform, Wagestream, found that most of their withdrawals are taken out c.8–10 days before the end of the month. By allowing salaried workers to access their accrued earning, Wagestream provides a financial cushion they can rely on that stops them having to go into overdraft or credit card debt. Wagestream highlights the benefit for employers to offer digital tools for financial wellness, as well as encouraging consumers to consider a wider range of financial wellness tools on the market. Wagestream observes that 40% of its users are no longer taking out a payday loan thanks to the app.

Personalisation

Tools like Incuto and Wagestream, as well as many of the recent budgeting apps or even utility switching services such as Youtility, rely on contextual and personalised data provided by Open Banking to help customers:

1. switch utilities seamlessly
2. benefit from personalised nudges to make the best-informed choices for them

As a consumer, the trust and mindset change required by Open Banking will hopefully rapidly evolve to understanding the opportunities it can bring for improved access to appropriate financial tools. FinTech companies are increasingly looking at ways to leverage technology to create and increase social impact.

Trust, Transparency, and Purpose

When rolling out and scaling access to these tools to low-income and vulnerable households, trust and transparency remain key. The FinTech market must demonstrate that it can be trusted in an era where abuse of data usage is a growing issue. Lastly, consumers are likely to be better off by adopting these new digital tools, but requiring behaviour change from the user isn’t always the best approach. Hence, the onus of behaviour change and adoption rests on the technology and partner infrastructure.

Choosing Your Digital Partner

When choosing to work with a FinTech offering some of these tools, the test is to see whether the team is committed to transparency, data accountability and ultimately, whether they are able to evidence a degree of purpose. This may be articulated through the founding team, more formally through defining their social objectives, or even taking on impact investment such as the Fair By Design Fund, indicating impact due diligence.

Originally published here.

More thought leadership

The post What makes a good digital partner for financial wellness? appeared first on Digital Leaders.